'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_app:wanhu_oa_api_downloadhttp.jsp_arbitrary_file_download_vulnerability（Rule ID：1070210448）

Release Date：2025/9/15

Rule Name：Wanhu OA API downloadhttp.jsp Arbitrary File Download Vulnerability

Severity：critical

CVE ID：

 

Descripiton：

Wanhu OA is a software that integrates a variety of office automation functions. It supports document management, transaction approval, knowledge management, etc., and also provides mobile office applications to help enterprises improve operational efficiency and employees' office experience. The 10,000 OA downloadhttp.jsp has any file read vulnerability. Attackers can download any file on the server through this vulnerability, which may leak sensitive information. This rule supports to defend the A6: Vulnerable and Outdated Components of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.